discordrat | aed0081d6aa8fa3b29d155c6bb45e9278b4562102f8d4497a51db56871a74134

Analysis

max time kernel
118s
max time network
121s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
02/06/2024, 02:09

Target
8da8b05938831e8e547b60526236ece7.exe
Size 78KB
Sample240602-clarasfc7w
SHA256 aed0081d6aa8fa3b29d155c6bb45e9278b4562102f8d4497a51db56871a74134
MD5 8da8b05938831e8e547b60526236ece7
SHA1 c27806eed416f8676548d89aa0207d028f800234
SHA512 552e09c36ec48d3117209546e70b1322b929d3f5c59f49af4e66f51c5123230bec766a7315de022027afc0d41920fa7f86f42d82e4f000ac73bab08136221ec6
SSDEEP 1536:52WjO8XeEXFh5P7v88wbjNrfxCXhRoKV6+V+MPIC:5Zv5PDwbjNrmAE+gIC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Family

Attributes

discord_token
MTI0NjE3NzQ1MDg3OTA5MDY5OA.GQYQs_.CWWy01exlwJSA5-Ryb8HsR5UWeE5uOF58bPcZs
server_id
1243377281129254984

Discord RAT
A RAT written in C# using Discord as a C2.
stealer rootkit rat persistence discordrat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2056	2256	8da8b05938831e8e547b60526236ece7.exe	28
PID 2256 wrote to memory of 2056	2256	8da8b05938831e8e547b60526236ece7.exe	28
PID 2256 wrote to memory of 2056	2256	8da8b05938831e8e547b60526236ece7.exe	28

C:\Users\Admin\AppData\Local\Temp\8da8b05938831e8e547b60526236ece7.exe
"C:\Users\Admin\AppData\Local\Temp\8da8b05938831e8e547b60526236ece7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2256 -s 596
  2⤵
  PID:2056

memory/2256-0-0x000007FEF55F3000-0x000007FEF55F4000-memory.dmp

Download

memory/2256-1-0x000000013FD40000-0x000000013FD58000-memory.dmp

Download

memory/2256-2-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

Download

memory/2256-3-0x000007FEF55F3000-0x000007FEF55F4000-memory.dmp

Download

memory/2256-4-0x000007FEF55F0000-0x000007FEF5FDC000-memory.dmp

Download